Upstream information
Description
Integer overflow in the rtxMemHeapAlloc function in asn1rt_a.lib in Objective Systems ASN1C for C/C++ before 7.0.2 allows context-dependent attackers to execute arbitrary code or cause a denial of service (heap-based buffer overflow), on a system running an application compiled by ASN1C, via crafted ASN.1 data.SUSE information
Overall state of this security issue: Resolved
This issue is currently rated as having critical severity.
| National Vulnerability Database | SUSE | |
|---|---|---|
| Base Score | 10 | 9.3 |
| Vector | AV:N/AC:L/Au:N/C:C/I:C/A:C | AV:N/AC:M/Au:N/C:C/I:C/A:C |
| Access Vector | Network | Network |
| Access Complexity | Low | Medium |
| Authentication | None | None |
| Confidentiality Impact | Complete | Complete |
| Integrity Impact | Complete | Complete |
| Availability Impact | Complete | Complete |
| National Vulnerability Database | |
|---|---|
| Base Score | 9.8 |
| Vector | CVSS:3.0/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H |
| Attack Vector | Network |
| Attack Complexity | Low |
| Privileges Required | None |
| User Interaction | None |
| Scope | Unchanged |
| Confidentiality Impact | High |
| Integrity Impact | High |
| Availability Impact | High |
| CVSSv3 Version | 3 |
Note from the SUSE Security Team
We do not track this CVE as affecting our products. We do not ship the asn1c compiler and we do not have indication that any of our packages contains code generated by that compiler. No SUSE Bugzilla entries cross referenced. No SUSE Security Announcements cross referenced.SUSE Timeline for this CVE
CVE page created: Wed Jul 20 06:15:13 2016CVE page last modified: Wed Oct 26 20:01:00 2022